HIPAA Compliant E-Signature Tools: Which Sign a BAA

HIPAA compliant e-signature means an e-signature tool whose vendor signs a business associate agreement (BAA) for the plan you use: Docusign offers one on its Enhanced plans, Adobe Acrobat Sign on enterprise or business plans for eligible accounts, PandaDoc on Annual Enterprise plans, Dropbox Sign on the team terms Dropbox lists, and Formstack on its HIPAA plans. The tool stores the signed documents for you, so if they hold protected health information (PHI), HIPAA lets you share them only once you have "satisfactory assurance" that the vendor will safeguard them, documented in a written contract: the BAA (45 CFR 164.502(e)). For the intake and lead forms that come before the paperwork, Curve Forms runs under the BAA Curve Compliance signs on every plan. Curve checked each vendor's own page on October 26, 2026.

Book a call. Signed paperwork usually starts with a form or a booking that came from an ad. Curve Compliance hosts HIPAA intake and lead forms under its BAA, sends each conversion to your ad platforms server-side, and strips PHI before data reaches an ad platform. Curve's team does the setup. Book a call with Curve.

Which e-signature tools sign a BAA?

Each row comes from the vendor's own page, fetched October 26, 2026. "Specific plans" means the vendor offers its BAA only on the plans or products it names.

Tool	Signs a BAA?	Plans or terms	How you get it	Source
Docusign	Specific plans	Enhanced plans; the plan comparison lists HIPAA support through BAA as not included on Personal, Standard and Business Pro	Contact Docusign sales	Docusign for Healthcare; eSignature plans
Adobe Acrobat Sign	Specific plans	Acrobat Sign for enterprise or business subscription plans; Adobe says not all accounts qualify	Sign the BAA with Adobe, which then turns on the account's linked BAA setting	Adobe Acrobat Sign help
PandaDoc	Specific plans	Annual Enterprise plans; the plan comparison lists HIPAA compliance as optional on Enterprise only	Contact PandaDoc support or sales	PandaDoc HIPAA; plan comparison
Dropbox Sign	Specific plans	Certain teams, with Dropbox Sign named on Dropbox's HIPAA page	Through Dropbox sales, or the admin console for US-based admins of a Dropbox team account	Dropbox Help Center
Formstack	Specific plans	Formstack Forms HIPAA plans; its HIPAA forms page lists gathering electronic signatures	Formstack's Standard BAA, or Formstack reviews a custom BAA	Formstack; data security

Tool names link to their BAA Directory entries where one exists, with the vendor's own words. Dropbox Sign is covered through Dropbox's HIPAA page; see the Dropbox entry. For form builders more broadly, see form builders that sign a BAA and survey tools that sign a BAA.

Each tool, in the vendor's words

• Docusign. "Docusign may enter into a Business Associate Agreement (BAA) with a HIPAA Covered Entity and in these scenarios Docusign agrees to meet HIPAA Business Associate obligations." The same FAQ says: "A company's products, including Docusign's, cannot be HIPAA compliant" (Docusign).
• Adobe Acrobat Sign. "Your organization may not process protected health information (PHI) through Acrobat Sign until the BAA is completed." Adobe adds that "The HIPAA readiness capability is only available through an Adobe Acrobat Sign for enterprise or business subscription plan," and that "Enabling HIPAA settings will prevent the use of the Salesforce Document Builder" (Adobe).
• PandaDoc. "In order to transmit electronic Protected Health Information (ePHI) using PandaDoc and maintain it with HIPAA compliance, customers should sign a Business Associate Agreement (BAA) with PandaDoc." Its plan comparison says "PandaDoc can support HIPAA compliance with a signed BAA for Annual Enterprise plans," and its FAQ says to contact the PandaDoc support team to sign one (PandaDoc; PandaDoc plans).
• Dropbox Sign. Dropbox's HIPAA article "applies to certain teams on Dropbox Standard, Dropbox Advanced, Dropbox Enterprise, Dropbox Education, Dropbox Business, Dropbox Business Plus, and Dropbox Sign." For a BAA, Dropbox points buyers to its sales team and says "If you're currently an admin of a Dropbox team account, you can sign a BAA electronically from the Account page in the admin console," an option for US-based customers only (Dropbox).
• Formstack. "Obtain consent with Formstack's Standard BAA, or let us evaluate your custom BAA requests." Its HIPAA forms page says the features let you "Gather electronic signatures," and its security page says "For our Formstack Forms HIPAA plan customers, we are committed to continued compliance with HIPAA" (Formstack; Formstack).

What HIPAA and federal law say about e-signatures

HIPAA covers the information, not the format. HHS says "The Privacy Rule protects all 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral" (HHS). A signed consent or intake packet that holds PHI is protected the same way on paper or in a signing tool.

The HIPAA Security Rule did not set an e-signature format. When HHS published it in 2003, it said "This final rule adopts only security standards," and that a final rule for electronic signatures "will be published at a later date" (68 FR 8334). What the Security Rule does ask of electronic PHI applies to signed documents too: "Implement policies and procedures to protect electronic protected health information from improper alteration or destruction," and "Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed" (45 CFR 164.312).

The ESIGN Act supplies the general rule. A signature or record "may not be denied legal effect, validity, or enforceability solely because it is in electronic form" (15 U.S.C. 7001), and an electronic signature is "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record" (15 U.S.C. 7006). Where a law requires that a consumer get information in writing, an electronic record counts only if "the consumer has affirmatively consented to such use and has not withdrawn such consent," after a clear disclosure of their rights (15 U.S.C. 7001(c)).

One HIPAA document always needs a signature: an authorization. Its core elements include "Signature of the individual and date" (45 CFR 164.508), and HHS says it "must be in plain language" (HHS). Marketing that uses PHI generally needs one; see HIPAA marketing authorization and ad tracking. Which rules apply to your documents depends on your setup and your state, so talk to your counsel.

What the BAA should cover for signed documents

The HIPAA rules list what every business associate contract must say (45 CFR 164.504(e)). For an e-signature vendor, three terms matter most:

• Safeguards. The vendor must "Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information" (45 CFR 164.504).
• Reporting. It must "Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information" (45 CFR 164.504).
• Return or destruction. At termination, "if feasible, return or destroy all protected health information" it still holds for you (45 CFR 164.504).

Check the edges too. Dropbox says third-party apps are "not covered by your Dropbox terms of use, including a BAA that you might sign with Dropbox" (Dropbox), and Adobe's HIPAA settings change which Salesforce features you can use (Adobe). Templates, reminder emails and integrations that copy signed data elsewhere each need a look. See what a business associate agreement is and the sample BAA.

Signed documents, forms and your ads

For many clinics, a signed intake packet or treatment agreement is the moment a lead becomes a patient, and it is tempting to count it as an ad conversion. The signing tool's BAA covers the document. It does not cover an ad pixel on the confirmation page, which sends data to a different company, and Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. Send the conversion as a neutral event with nothing from the document; see which ad platforms sign a BAA and what makes an intake form HIPAA compliant.

How Curve Compliance helps

The paperwork belongs in your signing tool. The steps before it, the ad click, the form and the booking, are where Curve Compliance works, under the BAA it signs on every plan. Curve Forms hosts intake and lead forms under that BAA, with logic, file upload fields, separate checkboxes for privacy consent and marketing consent, and a redirect after submit to your booking or next-step page. Form events reach Meta, Google Ads and your other destinations server-side, and form answers are never sent.

Across your site, Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: Docusign for Healthcare; Docusign eSignature plans; Adobe Acrobat Sign HIPAA configurations; PandaDoc HIPAA; PandaDoc plan comparison; Dropbox and HIPAA/HITECH; Formstack HIPAA forms; Formstack data security; 15 U.S.C. 7001; 15 U.S.C. 7006; 68 FR 8334; 45 CFR 164.502; 45 CFR 164.504; 45 CFR 164.508; 45 CFR 164.312; HHS Summary of the HIPAA Privacy Rule.

Frequently Asked Questions

Which e-signature tools are HIPAA compliant?

Tools whose vendor signs a BAA for your plan, set up the way the BAA expects: Docusign on Enhanced plans, Adobe Acrobat Sign on enterprise or business plans, PandaDoc on Annual Enterprise plans, Dropbox Sign on Dropbox's listed team terms, and Formstack on its HIPAA plans (Docusign; Adobe; PandaDoc; Dropbox; Formstack). Docusign itself says a company's products "cannot be HIPAA compliant," so the BAA and your setup are what count (Docusign).

Is Docusign HIPAA compliant?

Docusign says no product can be HIPAA compliant on its own, and that it may enter into a BAA with a HIPAA covered entity (Docusign). Its plan comparison offers HIPAA support through a BAA on Enhanced plans, through sales, and not on Personal, Standard or Business Pro (Docusign plans; Directory entry).

What is e-signature consent?

Under the ESIGN Act, when a law requires that a consumer get information in writing, an electronic record counts only if the consumer has affirmatively consented to it, has not withdrawn that consent, and first got a clear statement of their rights, including to paper copies (15 U.S.C. 7001(c)).

How do I create a digital signature?

Use an e-signature tool: you send the document and the signer adopts a signature in it. Under the ESIGN Act, any "electronic sound, symbol, or process" adopted with the intent to sign counts (15 U.S.C. 7006). For documents with PHI, pick a tool whose vendor has signed a BAA with you.

What are the legally acceptable digital signatures?

The ESIGN Act says a signature or contract may not be denied legal effect solely because it is electronic (15 U.S.C. 7001), and it accepts any electronic sound, symbol or process adopted with the intent to sign (15 U.S.C. 7006). Some documents carry extra rules, such as a HIPAA authorization's required elements (45 CFR 164.508).

What are the four types of signatures?

The ESIGN Act does not sort signatures into types. It uses one definition, an electronic sound, symbol or process adopted with the intent to sign (15 U.S.C. 7006), and HIPAA asks only that an authorization carry the individual's signature and date (45 CFR 164.508).

Does the HIPAA privacy rule protect all PHI electronic, verbal, and written?

Yes. HHS says the Privacy Rule protects all individually identifiable health information held or transmitted by a covered entity or its business associate, "in any form or media, whether electronic, paper, or oral" (HHS). The Security Rule adds safeguards for the electronic part.

Is Dropbox Sign HIPAA compliant?

Dropbox lists Dropbox Sign among the products its HIPAA article applies to, for certain teams, and says a BAA must be in place before you transfer PHI. For a BAA, Dropbox points buyers to its sales team; US-based admins of a Dropbox team account can sign one in the admin console (Dropbox).

Talk to Curve Compliance

Book a call. Keep your signing tool for the paperwork. Curve Forms and Curve's server-side tracking cover the forms and conversions before it, under the BAA Curve Compliance signs on every plan, with PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.